Log Analytics workspaces should prohibit ingestion that is not based on Azure Active Directory
This control checks whether `Log Analytics` workspaces block ingestion that is not based on `Azure Active Directory`. A compliant workspace should accept only data from sources that authenticate with `Azure Active Directory`.
Enforcing log ingestion to require Azure Active Directory authentication prevents unauthenticated logs from an attacker which could lead to incorrect status, false alerts, and incorrect logs stored in the system.
What this control checks
Log Analytics Workspaces should block non-Azure Active Directory based ingestion
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.log_analytics_workspace_block_non_azure_ingestion.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to PR.PS-04 (Log records are generated and made available for continuous monitoring.).
Framework mappings
The clauses this control is mapped to in each framework.
- 3.1.g Trails
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
log_analytics_workspace_block_non_azure_ingestion - Powerpipe Control:
azure_compliance.control.log_analytics_workspace_block_non_azure_ingestion
Last reviewed: 2026-10-13